2.1.2

This is a maintenance release.

Bug fix: Fix the issue that the login-fail-counter didn't work when the
validation at Login form was block by country (register, lost password).
In this release, the login-fail-counter works correctly.

Bug fix: Fix the issue that the validation settings of Admin area and
Admin ajax/post were influential with each other. Now each of those works
individually.

Bug fix: "Site Stats" of Jetpack is now shown on the admin bar which
issue was reported on support forum.

2.1.1

New feature: Added Block by country (register, lost password) at
Login form on Settings tab in order to accept the registered users as
membership from anywhere but block the request of new user ragistration and
lost password by the country code. Is't suitable for BuddyPress and bbPress.

Improvement: Added showing the custom error page for http response code
4xx and 5xx. For example the 403.php in the theme template directory or in
the child theme directory is used if it exists. And new filter hooks
ip-geo-block-(comment|xmlrpc|login|admin)-(status|reason) are available
to customize the response code and reason for human.

2.1.0

New feature: Expanded the operating range of ZP-ZEP, that includes admin
area, plugins area, themes area. Now it can prevent a direct malicios attack
to the file in plugins and themes area. Please go to the "Validation Settings"
on "Settings" tab and check it. Also check my article in
"Analysis of Attack Vector against WP Plugins".

Bug fix: Fixed the issue that action hook ip-geo-block-backup-dir did
not work correctly because the order of argument was mismatched.

Bug fix: Fixed the issue that a record including utf8 4 bytes character
in its columns was not logged into DB in WordPress 4.2.

Improvement: Fixed the issue that Referer Suppressor do nothing with a
new element which is added into DOM after DOM ready. The event handler is
now delegated at the body.

2.0.8

Fixed an issue that a certain type of attack vector to the admin area (
example
) could not be blocked by the reason that some plugins accept it on earlier
hook (ie init) than this plugin (previously admin_init).

2.0.7

2.0.6

Sorry for urgent update but avoid an javascript error.

2.0.4

Sorry for frequent update but added a function of showing admin notice
when none of the IP geolocation providers is selected. Because the user
will be locked out from admin screen when the cache expires.

Bug fix: Fixed an issue of get_geolocation() method at a time of
when the cache of IP address is cleared.

Added a sample code snippet as a use case for 'Give ajax permission in
case of safe actions on front facing page'. See Example 10 in sample.php.

2.0.1

Fixed the issue of improper scheme from the HTTPS site when loading js
for google map.

In order to prevent accidental disclosure of the length of password,
changed the length of * (masked password) which is logged into the
database.

2.0.0

New feature: Protection against brute-force and reverse-brute-force
attacks to wp-login.php, xmlrpc.php and admin area.
This is an experimental function and can be enabled on Settings tab.
Malicious access can try to login only 5 times per IP address. This retry
counter can be reset to zero by Clear statistics on Statistics tab.

1.4.0

New feature: Added a new class for recording the validation logs to
analyze posting pattern.

Fixed an issue of not being set the own country code at first installation.